The vulnerability of the software development environment for systems that automate technological processes, the Totally Integrated Automation Portal (Portal TIA), and the software used for modeling and simulating the operation of Siemens S7 controllers, arises from insufficient validation of input data. This allows attackers to execute arbitrary code.

The vulnerability of the software development environment for systems that automate technological processes, such as the Totally Integrated Automation Portal Portal TIA and software for simulating and testing the operation of Siemens S7 controllers, is related to insufficient verification of inpu...

Horner Automation Cscape 缓冲区错误漏洞

Horner Automation Cscape is a suite of programming software for industrial control system development from Horner Automation, USA. A buffer error vulnerability exists in Horner Automation Cscape version 10.0.363.1 and prior versions, which stems from improper validation of user-supplied data and...

PT-2024-41186 · Ооо 'Датэкс Софтвер' · E-Staff

Уязвимость системы автоматизации рекрутинговых процессов E-Staff связана с ошибками фильтрации данных при получении информации об объекте. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, получить несанкционированный доступ к защищаемой информации...

The vulnerability of the software development environment for systems that automate technological processes, the Totally Integrated Automation Portal (Portal TIA), and the software used for modeling and simulating the operation of Siemens S7 controllers, arises due to deficiencies in the deserialization mechanism, allowing attackers to execute arbitrary code.

The vulnerability of the software development environment of Totally Integrated Automation Portal Portal TIA, the software for modeling and simulation of Siemens S7 series controllers, is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows an attacker to...

PT-2024-39669 · Horner Automation · Horner Automation Cscape

Name of the Vulnerable Software and Affected Versions: Horner Automation Cscape affected versions not specified Description: The issue is related to a memory corruption vulnerability. This could allow an attacker to disclose information and execute arbitrary code. Recommendations: At the moment,...

Rockwell Automation Arena < 16.20.03 Multiple Vulnerabilities

The version of Rockwell Automation Arena installed on the remote Windows host is prior to 16.20.06. It is, therefore, affected by a number of different vulnerabilities - An “out of bounds write” code execution vulnerability exists in the affected products that could allow a threat actor to...

Rockwell Automation Arena < 16.20.06 Multiple Vulnerabilities

The version of Rockwell Automation Arena installed on the remote Windows host is prior to 16.20.06. It is, therefore, affected by a number of different vulnerabilities - A “use after free” code execution vulnerability exists in the affected products that could allow a threat actor to craft a...

CVE-2024-9845

Under specific circumstances, insecure permissions in Ivanti Automation before version 2024.4.0.1 allows a local authenticated attacker to achieve local privilege escalation...

CVE-2024-9845

Under specific circumstances, insecure permissions in Ivanti Automation before version 2024.4.0.1 allows a local authenticated attacker to achieve local privilege escalation...

CVE-2024-9845

CVE-2024-9845 affects Ivanti Automation prior to 2024.4.0.1. The issue is due to insecure permissions, enabling a local authenticated attacker to achieve local privilege escalation. The CVSS is 3.1/3.0-based vectors with a base score of 7.8 (HIGH) and local access requirements. Remediation: upgra...

CVE-2024-9845

Under specific circumstances, insecure permissions in Ivanti Automation before version 2024.4.0.1 allows a local authenticated attacker to achieve local privilege escalation...

CVE-2024-9845

Under specific circumstances, insecure permissions in Ivanti Automation before version 2024.4.0.1 allows a local authenticated attacker to achieve local privilege escalation...

New Malware Technique Could Exploit Windows UI Framework to Evade EDR Tools

A newly devised technique leverages a Windows accessibility framework called UI Automation UIA to perform a wide range of malicious activities without tipping off endpoint detection and response EDR solutions. "To exploit this technique, a user must be convinced to run a program that uses UI...

Teaching an Old Framework New Tricks: The Dangers of Windows UI Automation

...

Teaching an Old Framework New Tricks: The Dangers of Windows UI Automation

...

Tungsten Automation Power PDF JP2 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tungsten Automation Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

PT-2024-17645 · Tungsten Automation · Tungsten Automation Power Pdf

Name of the Vulnerable Software and Affected Versions: Tungsten Automation Power PDF affected versions not specified Description: This issue allows remote attackers to disclose sensitive information on affected installations of Tungsten Automation Power PDF. User interaction is required to exploi...

Tungsten Automation Power PDF JP2 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tungsten Automation Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Tungsten Automation Power PDF JPF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tungsten Automation Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Tungsten Automation Power PDF JP2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Tungsten Automation Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists...